Creditworthiness assessment of individuals is listed as high-risk under the EU AI Act, so Spanish consumer lending credit analysts must be trained to exercise real human oversight. That means reading each agent's depth and verdicts, checking every figure's source, and owning the credit decision. GDPR, the AEPD and the Banco de España complete the frame.
What does a consumer lending credit analyst in Spain spend time on?
Analysts at banks and specialist lenders assess personal loans, point-of-sale finance for cars, furniture and dental treatment, and revolving credit cards. A file brings together the applicant's payslips or self-employed tax returns, bank statements, the Banco de España's central credit register, private bureau data and the lender's own history.
Two features shape the Spanish job. Point-of-sale finance arrives through retailers who want an answer while the customer waits, so speed pressure is high. And revolving credit pricing and transparency have drawn sustained legal scrutiny, so lenders want analysts who can show exactly how a decision and its terms were reached.
Where can agents help, and at what depth?
Because this is a high-risk use, depth matters twice over: each agent is certified on the lender's own past Spanish files, up to its role's ceiling, and kept at drafting level wherever a credit decision is involved.
| Use | Depth | Analyst's role |
|---|---|---|
| Gathering register, bureau and statement data | 1: reads and lists | Confirms completeness and dates |
| Income and expense summary | 2: drafts with sources | Traces figures, especially for self-employed applicants |
| Affordability calculation | 2: drafts under policy | Confirms inputs and the result |
| Pre-contract information and decline letters | 2: drafts from the analyst's decision | Checks clarity and accuracy of terms |
| Disbursement to the retailer or customer | 4, held | Released by a named person after approval |
How should analysts review an agent's work?
The method in how credit analysts review an agent's decisions applies, with a Spanish emphasis on explainability:
- Read the verdict and the bound that decided it: role scope, certificate, sources, the lender's limits or the platform guardrails.
- Check provenance. The central credit register is a strong source; an uploaded payslip is declared; a document forwarded by a retailer is external and cannot alone support approval.
- Trace one figure, such as net monthly income, from the draft to its source line.
- Write the reason for your decision in words a customer could be given.
Every correction should be banked, so the agent improves rather than repeating the error. Teaching credit analysts to bank corrections shows the routine.
What stays with the analyst?
The credit decision and its terms stay with the analyst, as do exceptions, refinancing for borrowers in difficulty, fraud suspicion and any case where the applicant seems vulnerable. This is not a formality. Under the EU AI Act, the deployer must assign human oversight to people with the competence, training and authority to understand the system's output and to override it. An analyst who cannot explain a draft, or who signs without checking, is not providing that oversight.
That is also why analysts are not being replaced, a question answered in will agents replace credit analysts. Analysts should also know the agent's lifecycle: its certificate lapses after 90 days, and a lapse or a run that clears no depth drops it to depth 1 the same day. Record approval rights in an approver authority matrix for the lending team and training status in an AI agent competency matrix for the credit team.
Which rules in Spain shape oversight and literacy?
The EU AI Act lists creditworthiness assessment and credit scoring of natural persons in Annex III as high-risk. Deployers have obligations under Article 26, including using the system according to instructions, assigning human oversight to competent people and keeping logs. Article 14 sets what oversight must make possible. Article 27 requires a fundamental rights impact assessment for certain deployers, and lenders should check whether it applies to them. Article 4 requires measures to ensure sufficient AI literacy among staff dealing with AI systems.
GDPR applies through the AEPD. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and a credit decline is the classic example. Article 35 requires a data protection impact assessment where processing is likely to result in high risk. The Banco de España supervises lenders' conduct and transparency, and the EBA's expectations on loan origination call for sound, documented creditworthiness assessment.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day plan
Month one covers literacy for every analyst and credit manager: depth, the four verdicts, provenance, and what high-risk status means for their own signature. Use anonymised Spanish files, including a self-employed applicant and a point-of-sale case.
Month two is supervised review. Analysts review agent-drafted summaries daily and calibrate weekly on a shared set, writing down disagreements and how they were settled. Credit managers sample the reasons analysts record.
Month three ties approval rights to a current certificate, rehearses a certificate lapse, and tests whether the record would let you reconstruct three decisions end to end for a supervisor. The guide to AI agent skills by role shows how this fits with retailer-facing staff.
Where the Academy fits
Pryme Intelligence Academy trains analysts with module tests set in consumer lending. The Operator track ends with a written exam (32 of 40 correct to pass) and a two-week practicum of real review decisions with no missed red line. Certificates are valid 12 months and can be checked at source, which gives evidence of the competence Article 26 asks for.
Questions people ask
Is a human signature enough to avoid Article 22?
Only if the person meaningfully reviews the decision and can change it. A rubber stamp does not take a decision out of the solely automated category.
Do point-of-sale retailers need training too?
Retail staff who pass applications should understand what the agent does and does not decide. The credit decision stays with the lender's trained analysts.
Must every lender carry out a fundamental rights impact assessment?
Article 27 applies to certain deployers, not all. Check with counsel whether your organisation falls within it.